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Abstract 

In this work, we study the fundamental problem of reliable interactive communication over a 
noisy channel. In a breakthrough sequence of papers published in 1992 and 1993 [Sch92, Sch93], 
Schulman gave non- constructive proofs of the existence of general methods to emulate any 
two-party interactive protocol such that: (1) the emulation protocol only takes a constant- 
factor longer than the original protocol, and (2) if the emulation protocol is executed over a 
noisy channel (BSC), then the probability that the emulation protocol fails to perfectly emulate 
the original protocol is exponentially small in the total length of the protocol. Unfortunately, 
Schulman's emulation procedures either only work in a model with a large amount of shared 
randomness [Sch92], or are non-constructive in that they rely on the existence of good tree 
codes [Sch93]. The only known proofs of the existence of good tree codes are non-constructive, 
and finding an explicit construction remains an important open problem. Indeed, randomly 
generated tree codes are not good tree codes with overwhelming probability. 

In this work, we revisit the problem of reliable interactive communication, and obtain the 
following results: 

• We introduce a new notion of goodness for a tree code, and define the notion of a potent 
tree code. We believe that this notion is of independent interest. 

• We prove the correctness of an explicit emulation procedure based on any potent tree code. 
(This replaces the need for good tree codes in the work of Schulman [Sch93].) 

• We show that a randomly generated tree code (with suitable constant alphabet size) is 
a potent tree code with overwhelming probability. Furthermore we are able to partially 
derandomize this result using only 0{n) random bits, where n is the depth of the tree. 

These (derandomized) results allow us to obtain the first fully explicit emulation proce- 
dure for reliable interactive communication over noisy channels with a constant communication 
overhead, with failure probability that is exponentially small in the length of the original com- 
munication protocol. 

Our results also extend to the case of interactive multi-party communication among a con- 
stant number of parties. 



1 Introduction 



In this work, we study the fundamental problem of reliable interactive communication over a noisy 
channel. The famous coding theorem of Shannon [ShaOl] from 1948 shows how to transmit any 
message over a noisy channel with optimal rate such that the probability of error is exponentially 
small in the length of the message. However, if we consider an interactive protocol where individual 
messages may be very short (say, just a single bit), even if the entire protocol itself is very long, 
Shannon's theorem does not suffice. 

In a breakthrough sequence of papers published in 1992 and 1993 [Sch92, Sch93], Schulman 
attacked this problem and gave a non- constructive proof of the existence of a general method to 
emulate any two-party interactive protocol such that: (1) the emulation protocol only takes a 
constant-factor longer than the original protocol, and (2) if the emulation protocol is executed over 
a noisy channel (specifically a Binary Symmetric Channel 1 with some constant crossover probability 
less than i), then the probability that the emulation protocol fails to perfectly emulate the original 
protocol is exponentially small in the total length of the protocol. Unfortunately, Schulman's 1992 
emulation procedure [Sch92] either required a nonstandard model in which parties already share 
a large amount of randomness before they communicate, where the amount of shared randomness 
is quadratic in the length of the protocol to be emulated, or required inefficient encoding and 
decoding. On the other hand, Schulman's 1993 emulation procedure [Sch93] is non-constructive 
in that it relies on the existence of good tree codes 2 . The only known proofs of the existence of 
good tree codes are non-constructive, and finding an explicit construction remains an important 
open problem. Indeed randomly generated tree codes are not good tree codes with overwhelming 
probability. 

In this work, we revisit the problem of reliable interactive communication, and give the first 
fully explicit emulation procedure for reliable interactive communication over noisy channels with a 
constant communication overhead, with failure probability that is exponentially small in the length 
of the original communication protocol 3 . To obtain this result, we do the following: 

• We introduce a new notion of goodness for a tree code, and define the notion of a potent tree 
code. We believe that this notion is of independent interest. 

• We prove the correctness of an explicit emulation procedure based on any potent tree code. 
(This replaces the need for good tree codes in the work of Schulman [Sch93].) This procedure 
is efficient given a black box for efficiently decoding the potent tree code. 

• We show that a randomly generated tree code (with suitable constant alphabet size) is a 
potent tree code with overwhelming probability. Furthermore, we show that a randomly 
generated tree code (when combined with a good ordinary error-correcting code) can be 
efficiently decoded with respect to a BSC with overwhelming probability. 

• Finally, we are able to partially derandomize the above result using only 0{n) random bits, 
where n is the depth of the tree, while maintaining the efficiency of decoding. 

The Binary Symmetric Channel with crossover probability p is one that faithfully transmits a bit with probability 
1 — p, and toggles the bit with probability p. Note that Schulman's results as quoted here extend to the case of any 
discrete memory less channel with constant capacity, as do all of our results. 

2 We note, with apology, that what we are calling a "good tree code" is what Schulman calls a "tree code." We 
make this change of terminology because we will introduce an alternative relaxed notion of goodness for a tree code 
that will lead to our notion of a "potent tree code." 

3 Here we assume that we know the length of the protocol in advance. 



1 



With the above work done, our result is immediate: Since only 0(n) random bits are needed, 
they can be chosen once and for all, encoded using an ordinary block error-correcting code, and 
sent to the other party. Then a deterministic procedure can be used to finish the protocol. 

Our result extends to the case of any constant number of parties. For the case of a super- 
constant number of parties, however, our explicit emulation procedure will have a 0(m) slowdown 
for m parties (regardless of the length of the protocol). A (non-explicit) emulation procedure 
based on good tree codes was given by Rajagopalan and Schulman [RS94] that achieved a O(logm) 
slowdown in the general case. 

Also, another result we obtain relates to the recent work of Braverman and Rao [BRIO]. They 
consider whether good tree codes can be used to improve the result of Schulman for adversarial 
errors — which only works if the fraction of errors is below 1/240. They obtain a very significant 
improvement: as long as the fraction of errors is at most 1/4 — e, any protocol can be simulated with 
only a constant slowdown, using a good tree code over a constant-size alphabet (the simulation 
tolerates a 1/8 — e error fraction when using a binary alphabet). We show that a similar result 
can be obtained replacing the good tree code with a potent tree, showing our notion is useful even 
for the case of arbitrary (adversarial) errors. However, in this case, like all previous work on the 
adversarial error case, we do not know how to obtain efficient decoding against adversarial errors. 

Our approach. We begin our investigation by asking the question: What properties does a 
tree code need in order to be useful for emulating protocols over noisy channels? (Without loss 
of generality, assume that protocols only exchange one bit at a time from each party.) For the 
purpose of this paper, a tree code is simply any deterministic on-line encoding procedure in which 
each symbol from the input alphabet £ is (immediately) encoded with a single symbol from the 
output alphabet S, but the encoding of future input symbols can depend on all the input symbols 
seen so far. As such, any such deterministic encoding can be seen as a complete |S|-ary tree with 
each edge labeled with a single symbol of the output alphabet S. 
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Figure 1: A very bad tree code 

The usefulness of some kind of tree code for protocol emulation seems immediate, since each 
party must encode the bit it needs to send, before knowing what other bits it needs to send later 
(which it will not know until it receives messages from the other party). Let us associate every 
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path from the root to a node in the tree code with the concatenation of output symbols along that 
path. Then, at first glance, it may appear that all we need from the tree code is for "long-enough" 
divergent paths to have large relative Hamming distance. That is, suppose that the tree code 
illustrated in Figure 1 has the property that the relative Hamming distance between the path from 
node 1 to P and the path from node 1 to P' is very small, even though each of those paths is long. 
This would certainly be problematic since the protocol execution corresponding to each path could 
be confused for the other. As long as all long divergent paths had high Hamming distance, however, 
it seems plausible that eventually the protocol emulation should be able to avoid the wrong paths. 
Also, it is important to note that with suitable parameters, a randomly generated tree code would 
guarantee that all long divergent paths have high relative Hamming distance with overwhelming 
probability. 

However, this intuition does not seem to suffice, because while the protocol emulation is pro- 
ceeding down an incorrect path, one party is sending the wrong messages - based on wrong inter- 
pretations of the other party's communication. After a party realizes that it has made a mistake, 
it must then be able to "backtrack" and correct the record going forward. The problem is that 
even short divergent paths with small relative Hamming distance can cause problems. Consider 
the tree code illustrated in Figure 2. In this figure suppose the path along the nodes 1, 2, and 3 
is the "correct" path, but that the short divergent paths from 1 to A, 2 to B, and 3 to C all have 
small relative Hamming distance to the corresponding portions of the correct path. Then in the 
protocol emulation, because of the bad Hamming distance properties, the emulation may initially 
incorrectly proceed to node A, and then realize it made a mistake. But instead of correctin! g 
to a node on the correct path, it might correct to the node A' and proceed down the path to B. 
Then it may correct to B', and so on. Because the protocol emulation keeps making mistakes, it 
may never be able to successfully backtrack and communicate the messages that correspond to the 
actual protocol execution. 



Schulman [Sch93] dealt with this problem by simply insisting that all divergent paths have 
large relative Hamming distance in his definition of a good tree code. This would prevent all such 
problems, and guarantee that errors in emulation could only be caused by actual channel errors. 
The downside of this approach is that randomly generated tree codes would have short divergent 




Figure 2: A bad tree code 



3 



paths with small (even zero) relative Hamming distance with overwhelming probability, and thus 
would not be good tree codes. 

Our main observation is that this requirement goes too far. If a tree code has the property that 
for every path from root to leaf, there are only a few small divergent branches with low relative 
Hamming distance (as illustrated in Figure 3), then the emulation protocol will be able to recover 
from these few errors without any problems. We call such tree codes potent tree codes since they are 
sufficiently powerful to enable efficient and reliable interactive communication over a noisy channel. 

More precisely, let e and a be two parameters from the interval [0, 1]. Define a path from node u 
to a descendant node v (of length £) to be a-bad if there exists a path from u to another descendant 
node w (also of length £) such that the Hamming distance between the u-v path and the u-w path 
is less than a£. Then an (e, a) -potent tree code of depth n is such that for every path Q from root 
to leaf, the number of nodes in the union of all a-bad subpaths of Q is at most en. 




Figure 3: A potent tree code 

We show that randomly generated tree codes (with suitable constant alphabet sizes) are po- 
tent tree codes with overwhelming probability. As hinted above, because every root-leaf path has 
good properties, a potent tree code will work for emulating any (adversarially chosen) interactive 
protocol. With some additional randomization, we show that within such emulations, decoding 
of a randomly generated potent tree code can be done efficiently even for an adversarially chosen 
protocol. 

Naturalness of our definition. We argue that our notion of bad subpaths in a potent tree code 
captures the level of local "confusion" that is possible in a tree code, in a manner that we see as 
analogous to how ordinary symbol overlap (Hamming "closeness") captures such confusion in the 
context of ordinary error-correcting codes, which are much less structured objects. In this analogy, 
potent tree codes with e = (which correspond to Schulman's good tree codes) are analogous to 
maximum distance separable (MDS) codes in the context of ordinary error-correcting codes. Just 
as MDS codes are powerful and useful objects, but not necessary for most applications of error- 
correcting codes, we think of Schulman's good tree codes as being powerful and useful objects, but 
not necessary for important applications like reliable interactive communication where potent tree 
codes suffice. 
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Other Related Work. In 2006, Peczarski [Pec06] provides a randomized way for constructing 
good tree codes. The construction succeeds with probability 1 — e using alphabet with size propor- 
tional to e" 1 . Therefore, using Peczarski's method to construct a good tree code with exponentially 
small failure probability e, yields a polynomial slowdown; or a sub-linear but super-logarithmic slow- 
down if e is negligible (in the length of the simulated protocol). Other methods for constructing 
a good tree code are reported by Schulman [Sch03], yet they require polynomial-size alphabet (in 
the depth of the tree), resulting in a logarithmic slowdown using Schulman's emulation [Sch93]. 
Schulman [Sch03] also provides methods for constructing tree codes with weaker properties such 
as satisfying the Hamming distance property for only a logarithmic depth (which yields a failure 
probability that is inverse-polynomial). Ostrovsky, Rabani, and Schulman [ORS05] consider a re- 
laxed problem of communication for control of polynomially bounded systems, and gave explicit 
constructions of codes suitable for that setting. 

In work concurrent and independent to ours, Moitra [Moill] introduced a relaxation of good 
tree codes that he calls local tree codes, which allows him to obtain a fully explicit and deterministic 
emulation protocol, but which obtains error probability that is a fixed inverse polynomial in the 
length of the protocol. In contrast, our work obtains a fully explicit randomized emulation protocol, 
but achieves error probability that is exponentially small in the length of the protocol. 

2 Preliminaries 

We begin with several definitions that we use later. Unless otherwise mentioned, we use base 2 for 
all logarithms. 

Definition 1. We say that a function f(n) is negligible in n, and denote f < neg(n) if for any 
polynomial P, and sufficiently large n, f(n) < p^y- 

Our model of communication is based on a binary channel that flips each bit with probability 
Pbsc, independently of other bits. 

Definition 2. A binary symmetric channel (BSC) with error probability pbsc * s a binary channel 
{0, 1} — > {0, 1} such that for every inputed bit outputs the same bit with probability 1 — pbsc or the 
complementary bit with probability pbsCj independently of previous transmissions (memoryless) . 

One can use codes in order to send messages which can be recovered except with arbitrary 
small probability. This is done by adding redundancy to each message, according to the desired 
error probability. Shannon's coding theorem asserts the existence of an error-correcting code that 
reduces the error probability (for a single message) to be exponentially small, while increasing the 
amount of transmitted information by only a constant factor. 

Lemma 2.1 (Shannon Coding Theorem [ShaOl]). For a BSC channel with capacity C , an alphabet 
S and any £ > 0, there exists a code enc : S — > {0, l} n and dec : {0, l} n — > S with n = 0(<^£ log 
such that 

Pr[dec(BSC(enc(m))) ^ m] < 2~ u ^ lo ^ s \\ 

Although throughout this paper we assume the channel is a BSC with symbol error of at most p 
(using an error correction code), our result applies for any memoryless noisy channel with maximal 
symbol error probability p. 
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The main structure we use is a tree code, introduced by Schulman [Sch93, Sch96]. Each edge 
in a tree code is assigned with a label (from a given alphabet S), such that strings obtained by 
concatenation of these labels form a code, that is, have a large Hamming distance. 

Definition 3. The Hamming distance of two strings a = o~\ . . . cr m and &' = &[... a' m of the same 
length over an alphabet S, is the number of positions i such that cjj ^ a[. The Hamming distance 
is denoted by A(a,a'). 

As said earlier, we re-define the term tree code to be any tree, such that every arc i in the tree 
has a label ai over some fixed alphabet S. Denote with w(s) the label of the arc between s and 
its parent and W{s) the concatenation of the labels along the route from the root to the node s. 
Using our new terminology, the tree codes introduced by Schulman [Sch96] are denoted as good tree 
codes. 

Definition 4 (Tree Codes [Sch96]). A good d-ary tree code over an alphabet S, of distance 
parameter a and depth n, is a d-ary tree code of depth n such that for every two nodes s and r at 
the same depth, 

A(W(s),W(r)) > al, 

where I is the distance from s and r to their least common ancestor. 

Tree codes can be used to communicate a node u between the users, by sending the labels 
W(u). Decoding a transmission means recovering the node at the end of the route defined by the 
received string of labels. In order to reduce the error probability of the label transmission, each 
label is separately coded using a standard error-correcting code. It is shown in [Sch96] that for 

every distance parameter a G (0, 1), there exists a good d-ary tree code of infinite depth, labeled 

i 

using \S\ < 2[(2(i) 1 - Q j — 1 symbols. However, although it is known to exist, its explicit efficient 
construction remains an open question. 

3 Potent Tree Codes 

3.1 Potent Tree Codes and Their Properties 

We now formally define the set of potent trees and its complement, the set of bad trees. The latter 
contains trees that are not useful for our purpose: at least one of their paths is composed of "too 
many" sub-paths that do not satisfy the distance condition, i.e., the total length of these sub-paths 
is at least e fraction of the tree depth N , for some fixed constant e > 0. Formally, 

Definition 5. Let u, v be some nodes at the same depth h of a tree-code, and let w be their least 
common ancestor, located at depth h — I. The nodes u and v are a-bad nodes (of length I) if 
A(W(u), W(v)) < a£. In this case, the path (of length £) between w and u is called an a-bad path 
(similarly, the path between w and v would also be a bad path). Define the imposed a-bad interval 
( of length t) as the interval [h — £, h] . 

Definition 6. An (e,a)-bad tree is a tree of depth N that has a path containing a-bad subpaths, 
such that their union is of total length at least eN. 

Definition 7. An (e,a)-potent tree code is a tree of depth N, such that for every path Q from 
root to leaf, the union of all bad subpaths of Q is of length less than eN . In other words, the tree 
is not an (e,a)-bad tree. 
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We stress that a bad tree is not necessarily bad in all of its paths, since the existence of a single 
bad path is sufficient. 

Conveniently, it is rather simple to construct a potent tree, which makes it a feasible tool for 
plenty of applications. In the following we give two methods for constructing potent trees. The 
straightforward method is to randomly pick each label of the tree. The obtained Random Tree 
Code (RTC) is a potent tree except with probability exponentially small in the depth of the tree. 
The drawback of the first construction, is that its description is exponential. However, we observe 
that our proof does not require the entire tree to be random, but rather makes a use of the fact that 
any two paths along the tree are independent. Using the method of Alon, Goldreich, Hastad and 
Peralta [AGHP92] we are able to construct a tree in which any two paths are almost independent. 
Moreover, such a tree has an efficient description. 

3.2 Random Tree Codes as Potent Trees 

Definition 8. Let S be a finite alphabet. A random tree code (RTC) is a d-ary tree, where each 
arc i has a label a\ € S, randomly and independently chosen. 

Intuition. It is important to note that a RTC might not be a good tree code according to Def- 
inition 4. However, with high probability, the RTC can be used to replace a tree code, without 
significantly damaging the probability of success. Informally speaking, we can think of a RTC as 
using a good tree code, but increasing the channel error rate. Indeed, the only difference is that 
with a probability of 1/\S\ two edges in the RTC are assigned with the same label (and as a con- 
sequence some paths might not satisfy the distance condition). An equivalent result is obtained 
by taking a good tree code and "forcing" the channel to make an error during the transmissions 
related to those edges. This leads to an expected increase of 1/\S\ in the channel's error rate. 

Theorem 3.1. Suppose e, a € (0,1). Except with probability 2~^( N \ a RTC with alphabet \S\ > 
(2d)( 1+2 / £ )/( 1 - Q ) is {e, a) -potent. 

The proof is given in Appendix A. 



3.3 Small-Biased Random Trees as Potent Trees 

In order to agree on a RTC with alphabet S, the users need to communicate (or pre-share) 
0(d N log \S\) random bits. Surprisingly, we can reduce the description size to 0(N \og\S\) and 
still have a potent code with overwhelming probability. This is allowed due to Alon et al.'s con- 
struction of a sample space with an efficient description that is e-biased [AGHP92] . 

Definition 9 (e-biased sample space [NN90, AGHP92]). A sample space X on n bits is said to 
be e-biased with respect to linear tests if for every sample x\ ■ ■ ■ x n and every string a\ ■ ■ ■ ot n € 
{0, l} n \ {0} n , the random variable y = Ya=i a i x i m od 2 satisfies | Pr[y = 0] — Pr[y = 1]| < e. 

We use [AGHP92, Construction 2] to achieve a sample space B n which is e-biased with respect 
to linear tests. Let p be an odd prime such that p > (n/e) 2 , and let Xp( x ) De the quadratic character 
of x (mod p). Let B n be the sample space described by the following construction. A point in the 
sample space is described by a number x G [0, 1, . . . ,p — 1], which corresponds to the n-bit string 
r(x) = ro(x)ri(x) • • • r n _i(x) where rj(x) = 1 Xp( x +i) _ 
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Proposition 3.2 ([AGHP92], Proposition 2). The sample space B n is + —biased with respect 
to linear tests. 

We use the above to construct a d-ary tree code of depth N with labels over an alphabet S. 
Without loss of generality we assume that \S\ is a power of 2, and describe the tree as the d N log | *S' | — 
bit string constructed by concatenating of all the tree's labels in some fixed ordering. Since each 
n-bit sample describes a tree-code, we are sometimes negligent with the distinction between these 
two objects. 

Definition 10. A d-ary Small-Biased Tree Code (SBTC) of depth N , is a tree described by some 
sample from the sample space B n with n = d N log \S\, e = l/2 cN1 ° s \ s \ for some constant c that we 
can choose later. 

We note that small-bias trees have several properties which are very useful for our needs. 
Specifically, every set of labels are almost independent. 

Definition 11 (almost A;-wise independence [AGHP92]). A sample space on n bits is (e,k)- 
independent if for any k positions i\ < ii < ■ ■ ■ < ik and k-bit string 

\Pr[x h x i2 ■ ■ ■ x ik =£}-2~ k \ <e 

Due to a lemma by Vazirani [Vaz86] (see also corollary 1 in [AGHP92]), if a sample space is e- 
biased with respect to linear tests, then for every k, the sample space is ((1 — 2~ k )e, /c)-independent. 
Thus, B n is (e, fc)-independent, for any k. 

Corollary 3.3. Let T be a d-ary SBTC of depth N, then any 1 < k < d N labels of T are almost 
independent, that is, any k\og\S\ bits ofT's description are (2~ cNl ° s ^ s ^,k)-independent. 

Finally, let us argue that such a construction is efficient. Let p = 0((n/e) 2 ) and assume a 
constant alphabet \S\ = 0(1). Each sample x takes logp = O(N) bits, and each rt(x) can be 
computed by poly(N) operations. 

We now show that the properties shown in Appendix A for a RTC, hold for a SBTC as well. 

Proposition 3.4. Suppose e, a 6 (0,1). Except with probability 2~^ N \ a SBTC of depth N over 
alphabet \S\ > (2d)( 2 + 2 / £ )/( 1 - Q ) is (e, a)-potent. 

Proof. We show that the probability of a SBTC to be (e,a)-bad is exponentially small. We begin 
by fixing a leaf z, and later use a union bound to bound the probability over the entire tree. Assume 
that the tree is bad, that is, there exist bad intervals of total length eN. Due to Lemma A. 3 there 
must exist disjoint bad intervals of total length at least eN/2. 

There are at most Ylf=eN/2 Cj) — ^ N ways to distribute these disjoint intervals along the 
path from root to z. In a similar way to Lemma A.l, we can bound the probability of having 
a node u at the same depth as z which imposes a bad interval of length t. Since the tree is 
(l/2 cAri °sl 5 l, 2/ log I^D-independent, the suffixes (of length I) of the label sequences W(u) and W(z) 
are almost independent. For / > and a node u denote by W[(u) the last I symbols of W(u). 

Lemma 3.5. For any two nodes at the same level z,u with a common ancestor I levels away, 

Pv[A(W(u),w(z))=j] < (^y^ + jrw 
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Proof. Note that W(u) and W(v) are identical except for their suffix of length I. 

Pt[A(W(u),W(v)) = j) = 

Y, Pr[Wi(«) = £«, = &] Pr[A(W,(«), ^0)) = J I Wi(u) = £„, W t (v) = £„] 

< (2 -2Mo g |s| +2 -civiog|5| ) £ Pr [A(Wi(«),Wi(z;)) = j I W^u) =tu,W l (y) = &] 

< / 2 -aio g |S| + 2 -cAriog|5K 2 2nog|s/ 1 \ f I \ l j f\S\ -1^ 



i-jj \\s\j v \s\ 

Choosing c > 3 completes the proof. For the ease of notation, in the following we use 2(^ J ) 

as an upper bound of the above probability. □ 

The above lemma leads to the following bound on the probability that two nodes are a-bad. 
Corollary 3.6. 

al 

Pr[A(W(u), W(z)) < a l] = Y^ Pr[A(W(u), W(z)) = j] 

3=0 

± / l x / 1 vH 2 1 



3=0 



l-j) \\S\J ~ \S\^~ a ) 1 



Using a union bound, the probability that there exist a node u ^ z with common ancestor I level 
away, such that z and u do not satisfy the distance requirement is bounded by J2 U 2 igRT=5fl = 
2(2d/|,S| 1 - a ) i 

Consider again the path from root to z, and the disjoint bad intervals of total length at least 
eN/2 along it. There are at most 2N labels involved (along both the path to z and the colliding 
paths). Since the intervals are disjoint, their probabilities are almost independent as well, and 
the probability that a specific pattern of interval happens is bounded by the multiplication of the 
probabilities of each interval. 

According to the above, the probability for a SBTC to be (e, a)-bad is bounded by 

Pr[ SBTC is (e, a)-bad ] < II 2(2d/|5| 1_a ) A 

Z t\,i2,--- disjoint, i 

of length>eiV/2 

< d N ■ 2 N {Ad/\S\ l - a )^ k < (2d) N (Ad/\S\ 1 - a ) £N/2 
which is exponentially small in N for \S\ > (Ad ■ (2d) 2 ^) 1 ^ 1 ~ a \ □ 



4 Applications - Simulation with Adversarial Errors 

In a recent paper [BRIO] Braverman and Rao show how to simulate any 2-party protocol over a 
noisy channel, that is able to withstand an error rate of up to 1/4 — £2, for any constant 62 > 0. 
Their simulation uses good tree codes to communicate the process of the simulated protocol over 
the noisy channel. 
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We show that the analysis of Braverman and Rao can be repeated using a (ei, 1 — e2)-potent 
tree instead of a good tree code, and withstand error rate of up to 1/4 — 2ei — Intuitively, 
for every node which is not a-bad, the potent tree code behaves exactly like a good tree code 
(i.e., many channel errors are required for having a decoding error). On the other hand, for every 
possible path along the potent tree, there are at most e\N nodes which are (1 — £2)-bad, that is, 
at most additional e±N times in which the scheme differs from a good tree code (in each one of 
the directions of communication). This gives an algorithm that withstand up to 1/4 — (2ei + €2) 
fraction of (adversarial) errors. 

Theorem 4.1. For any 2-party binary protocol tt and any constant e > there exist a protocol U 
that simulates tt over a noisy channel using potent tree-codes, imposes a constant slowdown and 
succeeds except with negligible probability. 

See proof in Appendix B. 

5 Applications - Efficient Simulation with Random Errors 

We provide an efficient randomized algorithm that succeeds to simulate any interactive protocol over 
noisy channel with overwhelming probability. In 1992 Schulman proposed an efficient randomized 
scheme that solves this problem [Sch92] which requires quadratic communication 4 . By using potent 
trees (realized via SBTCs), we improve the result of Schulman and obtain a linear communication 
(i.e., a constant dilation) which includes the communication required to agree on the same SBTC. 
The scheme we obtain is efficient and constructive. We then extend our proof to any multiparty 
protocol following the analysis of Rajagopalan and Schulman [RS94], again, by replacing the good 
tree code with a potent tree. 

5.1 Interactive Protocol Over Noisy Channels 

Our setting considers a distributed computation of a fixed function /, performed by several users 
who (separately) hold the inputs. We begin by considering only two users and later extend our 
result to any number of users. Let tt be a 2-party distributed protocol which on inputs xa,xb, 
both parties output the value /(xa,xb)- In each round, A and B send a single message to each 
other, based on their input and messages previously received. The protocol tt assumes an ideal 
communication channel which contains no errors. Under these assumptions, tt takes T rounds of 
communication to output the correct answer, where one round means both users simultaneously 
send each other a message. 

In a more realistic model, the channel between A and B may be noisy, so that each message needs 
to be encoded in order to identify and correct possible errors. Shannon's Coding Theorem [ShaOl] 
(see Lemma 2.1) shows that an exponentially small decoding error in the length of the message 
\m\ can be achieved, if the message is encoded into a code word of length c\m\, for some constant 
c determined by the channel capacity. However, if we use a standard Shannon code to encode 
multiple messages, then the probability of having at least a single decoding error is proportional to 
the number of messages sent, rather than arbitrarily small. In this paper we explore the worst case 
scenario of the above tradeoff between the number of messages and their size. Namely, we assume 

4 The simulation itself impose a constant slowdown, however the users must share a parity-checking matrix of 
quadratic size. 
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that a total amount of T bits of information is divided into T messages of a single bit each. Our 
aim is to send 0(T) bits over the channel and obtain an exponentially small failure probability. 

Let us formulate the computation process of the protocol it. During each round, each user 
i S {A, B} sends one bit according to its input Xi and the messages received so far. Let ni(xi,$) 
denote the first bit sent by user i, and let n(x, 0) € {00, 01, 10, 11} be the two bits transmitted in 
the first round by A and B respectively, where x = xaxb- Generally, let mi, . . . ,rrit be the first t 
(2 bit-)messages exchanged during the protocol, then the information sent in round t + 1 is defined 
by tt(x, mi ■ ■ ■ fTh)- 



The computation (over a noiseless channel) can be described as a single route 7^ x along the 
GameTree, a 4-ary tree of depth T (see Figure 4). The path j niX begins at the root of the tree and 
the t th edge is determined by the 2 bits exchanged in the t th round, i.e., the first edge in the path 
is 7r(x,0), the second is tt(x, tt(x, 0)), etc. 

5.2 Simulating it Over a Noisy Channel 
5.2.1 The basic scheme 

Our goal is to calculate a protocol ir over a noisy channel. In order to do so, we use the method 
of Schulman [Sch96] described in Figure 5. [The protocol is described for user A. The protocol for 
B is identical.] The idea behind the simulation is the following. Each user keeps a record of (his 
belief of) the current progress of tt, described as a pebble on one of the GameTree nodes. 

Each round, according to the transmissions received so far, the user makes a guess for the 
position of the other user's pebble, and infers how his own pebble should move. The user sends a 
message that describes how he moves his pebble (out of the six possible movements matching the 
4 child nodes, 'FT to keep the pebble in the same place or 'B' to back up to the parent node) and 
the bit outputted by him, assuming the protocol is described by the new position of his pebble. 
Each one of these 12 options represents a child in a 12-ary tree denoted as the StateTree (Figure 4). 
The user communicates 6 the label assigned to the edge in the StateTree that describes his move. 

For the simulation to be well denned, we must extend n to N rounds. We assume that in each of the N — T 
spare rounds, n outputs for each user and every input. 

6 We imply here using a (standard) error-correcting code in order to send the label over the noisy channel, with 
constant slowdown (as given by Lemma 2.1). Throughout the paper, any transmission of a label is to be understood 
in this manner. 



GameTree 



StateTree 




Figure 4: The GameTree and the StateTree 
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Begin with own pebble at the root of GameTree and own state Sa at the StateTree root's child labeled 
H x tta{ x Ai V)- Repeat the following N times 5 : 

1. Send w(Sa) to user B. 

2. Given the sequence of messages Z received so far from user B, guess the current state g of B as 
the node that minimizes A(W(g), Z). From the guess g, infer B's pebble movements and compute 
the (alleged) current position pebble(g) of B's pebble and the bit b outputted by B for this round. 

3. Set your pebble movement and new state according to the current position v of your pebble and 
the following: 

(a) If v — pebble(g) then move own pebble according to the pair of bits (ka{xa, v), b) to a state 
v' . The new state is Sa's child labeled with the arc (tta(xa, v), b) x tta(xa, v'). 

(b) If v is a strict ancestor of pebble^): own movement is H, and the next state is along the 
arc H x ita(xa, v). 

(c) Otherwise, move own pebble backwards. New state is along the arc R x tta(xa, v') where v' 
is the parent of v. 



Figure 5: Interactive protocol Sirrv for noisy channels [Sch96] 

The state of the user is the current node on the StateTree, starting from its root, and changing 
according to the edge communicated. 

Informally speaking, the simulation works since the least common ancestor of both the user's 
pebbles always lie along the path j n>x . If both users take the correct guess for the other user's 
pebble position, they simulate ir correctly and their pebbles move along j njX - Otherwise, their 
pebbles diverge, yet the common ancestor remains on j n ^ x - On the following rounds, when the 
users acknowledge an inconsistency in the pebbles' positions, they move their pebbles backwards 
until the pebbles reach their common ancestor, and the protocol continues. The users will simulate 
7r as long as the number of divergences is small enough. It is shown in [Sch96] that repeating the 
above process for N = 0(T) rounds is sufficient for simulating ir with exponentially small error 
probability (over the channel errors). We refer the reader to [Sch96] for a detailed description of 
the protocol and its analysis. 

In order to be able to construct such a simulation, we replace the (non-constructive) good 12-ary 
tree code with a = 0.5 originally used by Schulman, by a potent tree. Surprisingly, this simple 
change is enough to obtain a constructible scheme for simulating interactive protocols over noisy 
channels. We note that in Section 5.3 we show that the same can be done using a ternary tree 
instead of a 12-ary tree, using the methods of [RS94]. However, for the clarity of the presentation, 
we first analyze the scheme using a 12-ary tree and only later optimize the result. 

Theorem 5.1. Given a (^j, a) -potent tree code with a constant-size alphabet \S\ (which depends 
on the constant a G (0, 1) ) and an oracle for a decoding procedure of that tree code, the protocol 
S'\m n (Figure 5) is an efficient simulation of the protocol tt (that has T rounds). It takes N = 0(T) 
rounds and succeeds with probability 2^^ T ^ over the channel errors, assuming the use of an error 
correcting code with (label) error probability p < 2 -42 / Q . 
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Moreover, if we are given an oracle to a tree code decoding procedure, the obtained protocol is 
efficient. In Section 5.2.2 we show a decoding procedure that is efficient on average, given that the 
tree is SBTC. This immediately leads to the following (main) Theorem. 

Theorem 5.2 (Main). There exists an efficient simulation that computes any distributed 2-party 
protocol ir of length T, using a BSC for communication and a pre- shared SBTC. The simulation 
imposes a constant slowdown, and succeeds with probability 1 — 2~^ T > over the channel errors and 
the choice of the SBTC. 

We now give the proof idea for Theorem 5.1 and later complete the formal proof. We begin 
by defining a good move: a move that advances the simulation of tt in one step, and a bad move: 
an erroneous step in the simulation that requires us to back up and re-simulate that step. We 
show that any bad move is associated with a decoding error, i.e., recovering a wrong node u, due 
to channel errors or tree defects. Thus, we can bound the number of bad moves by bounding 
the probability for channel errors and tree defects. Using (Shannon's) error correcting codes, the 
probability of a channel error is arbitrarily small, and so is the probability of having many channel 
errors. Furthermore, we use a potent tree code, to guarantee a small number of tree defects, except 
with an exponentially small probability. 

Recall the following properties of the simulation Sim,,-. 

Lemma 5.3 ([Sch96]). The least common ancestor of the two pebbles lies on 7^ x . 

Lemma 5.4 ([Sch96]). Let va and vb be the positions of the two pebbles in the GameTree at some 
time t, and let v denote the least common ancestor of va and vb- Define the mark of the protocol 
as the depth of v minus the distance from v to the further of va and vb- 

If during a specific round, both users guess the other's state correctly (a good move), the mark 
increases by 1. Otherwise (a bad move), the mark decreases by at most 3. 

A proof for both of the above lemmas is given in [Sch96]. 

Our goal is to show that the probability of having more than cN bad rounds is exponentially 
small. By setting c = 1/5 and N = 5T we guarantee that at the end of the calculation the mark 
will be (at least) T. Since the common ancestor of the pebbles always lies along the path 7^ x , a 
mark of value T indicates that the common ancestor has reached depth T, and ir was successfully 
simulated. 

For a bad round at time t, we assume that (at least) one of the users takes a wrong guess of 
the (other user's) current state. Suppose that the least common ancestor of the right state and the 
wrongly guessed state in the StateTree, is distanced I levels away (i.e., an error of magnitude I). 
Define the error interval (of length I) corresponding to the erroneous guess as [t — l,t]. 

We now show that given a potent tree, Si nv simulates tt over a noisy channel with overwhelming 
probability. 

Proof. (Theorem 5.1). Suppose the parties share a (A, a)-potent tree code 7 , for some < a < 1. 
Assume that a specific run of a simulation failed, and thus it must be that more than N/5 errors 
have occurred. 

7 Proposition 3.4 guarantees that as long as \S\ > (2d) 22 ^ 1 ~ a \ only a negligible fraction of the SBTCs are 
(yjj, a)-bad. Therefore, for obtaining a potent tree with overwhelming probability, we require log \S\ > 101. 



13 



Note that the simulation defines a path along the StateTree, from the root to one of the leaves. 
Since the StateTree is (j^, a)-potent, the specific path contains bad intervals of total length at 
most N/10. We assume a worst case scenario in which each a-bad node causes a bad move in the 
simulation. We show that the probability of having N/10 additional bad moves (in the remaining 
nodes, which are not a-bad) is exponentially small. 

Consider a specific bad move caused by erroneously decoding a node which is not a-bad, at 
time t. Namely, the user guesses a wrong node r instead of the real transmitted node s. For an 
error of magnitude It, W(s) and W{r) are identical from the root to the least common ancestor of 
r and s at level t — I. Since the decoding is done by minimizing the Hamming distance, making 
this wrong guess is independent of transmissions prior to round t — l. It follows that such an error 
(of magnitude I) can happen only if at least al/2 channel errors have occurred during the last I 
rounds. Due to the same reason, it is easy to see that decoding errors of which the error intervals 
are disjoint, are independent. 

We consider again the bad moves which are associated with a decoding error of nodes which are 
not a-bad. Each such a bad move (i.e., a decoding error) impose an error interval of length li > 1, 
and the union of these intervals must be of length at least N/10. Each such an error happens with 
probability at most X/j= a /72 Cj)&* — 2 l 'p ali ^ 2 . Due to Lemma A. 3 we can find a set of disjoint 
intervals of length at least N/20. Due to the discussion above, these errors are independent, and 
their probability to jointly occur is bounded by 

Tj2^ ! / 2 = (2 P a/2 y. 

i 

We conclude the proof by bounding the probability for having any possible error pattern of total 
length at least N/20 along the bad moves associated with nodes which are not a-bad, by using the 
union bound over all possible error patterns (there are at most X]jLjv/20 Cj) — ^ N sucri patterns), 
for each one of the users. The probability is bounded by 

52 J2 (2p a/2 ) 1 <2.2 N (2p a / 2 ) N/2 °, 

user U pattern of 

l>N/20 errors 

which is 2~ Q W = 2~ n( - T ) for p < 2~ 42 / Q . □ 
5.2.2 Performing decoding in an efficient way 

A decoding process outputs the node u (at depth t) that minimizes the Hamming distance between 
W(u) and the received string of labels r = riT2 ■ • ■ Tp Although the above Theorem 5.1 is proven 
assuming an oracle to tree-code decoding procedure, this requirement is too strong for our needs. 
Since we count any node which is a-bad as an error (even when no error have occurred), it suffices 
to have an oracle that decodes correctly given that the (transmitted) node is not a-bad. 

We follow the techniques employed by Schulman [Sch96] (which are based on ideas from [Woz57, 
Rei60, Fan63]), and show an efficient decoding that succeeds if the node is not a-bad. While the 
decoding process of [Sch96] is based on the fact that the underlying tree is a good tree code, in our 
case the tree code is a SBTC. 8 

8 A similar proof works also for a RTC. 
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The decoding procedure is the following. For a fixed time t, let gt-i be the current guess of 
the other user's state, and denote the node along the path from the root to gt-i as g±, g2, ■ ■ ■ , gt—i- 
Also, recall that r±, r2, ■ ■ ■ , r% are the labels received so far. If there exists a child of gt-\ whose edge 
is labeled rt, choose that child (break ties arbitrarily), otherwise, arbitrarily choose one of gt-i's 
child nodes. Denote with g t the new guess. 

Recall that W m (u) denotes the m-suffix of W(u), i.e., the last m symbols along the path from 
the tree's root to the node u. We look at the earliest time i such that A(rjrj + i • • -rt, Wt-i+i(gt)) > 
a(t — i)/2. For that specific i, exhaustively search the subtree of gi and set the new guess g as the 
node u (at depth t) that minimizes the Hamming distance A(rir2 • • • r t , W(u)). 

Note that when g t is an a-bad node of maximal length I, any path from the root to some other 
node g' t , where the least common ancestor of gt and g' t is located I' > I levels away, must have a 
Hamming distance A(Wi'(gt),Wi'(g' t )) > oil'. Therefore, if all the suffixes of length /' > I satisfy 
A(rt-i'+± ■ ■ - rt, Wi'(gt)) < oil' /2, it is guaranteed that the node minimizing the Hamming distance 
is within the subtree of gt-i- However, if g% is an a-bad node of length I, the decoding process 
might yield a wrong guess, i.e., a node in the subtree of gt-i that does not minimize the Hamming 
distance. 

The following proposition bounds the probability for a decoding error of magnitude I. 

Proposition 5.5. Assume a SBTC is used to communicate the string W(v) over a BSC. Using 
the efficient decoding procedure (with some constant a G (0,1)), the probability for a specific user 

to make a decoding error of magnitude I is bounded by 2 (^jzj^J +2 ^ [gp^ ) > if an error correction 
code with (label) error probability less than \S\~ 2 is used. 

Proof. A decoding error of magnitude I occurs if the decoding process outputs a node m/b, such 
that the common ancestor of u, v is I levels away. Such an error can happen due to one of the 
following reasons: 

(i) For the received string r = r\ri ■ ■ ■ r\ it holds that A(r, W{uj) < A(r, W(v)). This happens 
when the Hamming distance A(W(u),W(v)) is j = 0,1,..., I and more than j/2 channel 
errors occurred. 

(ii) The decoding process did not return the node that minimizes the Hamming distance. 

Note that we only need to consider the paths from root to u and to v and thus use the 2iV-wise 

independence of the tree's labels. Recall that the probability to have specific set of I < 2N labels 

is 2 - cNl °s\S\ away 

from uniform, with c = 0(1), and the probability for a given Haming distance 
between W(u) and W(v) is bounded by Lemma 3.5. Let p < \S\~ 2 be the maximal label error of 
the channel. Using a union bound for every possible node u, the probability of part (i) is bounded 
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by 



Pr[ Error of magnitude I ] 



< Yl Pr i A ( W ( v )i W(u)) = j] • Pr[> j/2 symbol-errors] 



u j=0 




which is exponentially small in I as long as IS"! > Ad. 

For part (ii), note that the decoding process does not return the node that minimizes the 
Hamming distance if I is larger than t — i, for the suffix determined by the decoding procedure 
(using the notations described above for the efficient decoding procedure). This implies that for 
the outputted node gt, A(rj • • • rt, Wf(gt)) < a(t — i) /2. Since gt is not the node that minimizes the 
Hamming distance, there must exist a node v of distance at most /, such that A(Wt(v ), r; L ■ ■ ■ r%) < 
A(rj • • • r t , Wl(g t ))- By the triangle inequality, the Hamming distance between the paths from v 
and g t to their least common ancestor must be at most al. Using the union bound for any possible 
such v and any possible Hamming distance up to al, we bound the probability of this event by 



We stress that the above decoding process always outputs the correct node (i.e., the node which 
minimizes the Hamming distance), if the transmitted node is not a-bad. For that reason, the 
analysis performed in the proof of Theorem 5.1 is still valid, since it only requires the decoding 
procedure to succeed when the node is not a-bad (and assumes that the simulation has a bad move 
in each node which is a bad node). 

We now show that this procedure is efficient in expectation. Let L(t) be the depth of the 
subtree explored at time t. The decoding process takes 0(J2tLi d L ^) steps (this dominates terms 
of 0(L(t)) required to maintain the guess, etc). 

For timet, if L(t) = I then A(r t _,+i ■ ■ ■ r t , W,(#)) > aZ/2yetfor/' > I, A(r t _,/+i ■ ■ ■ r t , W v (g t )) < 
al' /2. Assume that the sequence of labels transmitted is W(v) for some node v of depth t. The 
above requirements imply that the suffixes (of length I) of W(v) and W(gt) have Hamming distances 




i=o 



A union bound on the two cases completes this proof. 



□ 
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exactly \al/2~\. This happens with probability at most 

< Pr[A(Wi(gt), Wi(v) = j] Pr[> al/2 - j symbol -errors 

i=o 

I 

+ Yl Pr[A(Wi(st), Wi(u) = i] Pr[> j - q//2 symbol -errors 

i=M/2l 

z&LLMmT' £ Q)p fc (i-^- fc <2 2 ^i^r^/ 2 ), 

j=0 V -//Ml/ fc=|ai/2-i| V 7 

assuming p < \S\~ 2 . 

With a sufficiently large yet constant alphabet, e.g., \S\ > {^d) l ^ l ~ a / 2 \ we bound the proba- 
bility that L(t) equals I to be 2~ 7 ' < dr l . The expected running time is then given by 

V t=l 7 V t=l i=0 7 V i=l 7 

Since we repeat the simulation step for N = 0{T) times, the computation is efficient in expectation. 
To complete the proof, we mention that [Sch96] presents a data structure which allows us to perform 
the above decoding with overhead 0(L(t)). 



5.2.3 Simulating an adaptively chosen protocol 

For a given protocol, Sim,,- fails with exponentially small probability that depends on the choice of 
the SBTC and the BSC errors. Assume that the we first pick a potent tree and then the protocol 
7r is (adversarially) chosen. Due to Theorem 5.1, as long as the tree code is potent, the simulation 
succeeds with overwhelming probability, over the BSC errors alone. However, the decoding process 
described in Section 5.2.2 above, might no longer be efficient, since the adversary might force the 
simulation to travel through the "bad" regions in the tree that require exploring large subtrees. 

An interesting remedy to the above can be achieved by by introducing more randomness, which 
prevents the adversary from fixing the path along the StateTree the simulation takes. We now extend 
the basic scheme Sinv to the stronger notion of adversarially chosen protocol (Section 5.2.3), and 
prove the following theorem. 

Theorem 5.6. Except for probability 2~ n ( T ' ) over the choice of the SBTC, there exists an efficient 
scheme to simulate any 2-party protocol tt of length T , with success probability at least 1 — 2~ n ^ T " ) 
over the channel errors. 

As said above, the expected runtime for the decoding process described in Section 5.2.2 is no 
longer efficient in this case. The adversary can choose the simulated protocol tt and "fix" a path 
along the StateTree (up to channel errors). As the decoding process is efficient in expectation, the 
path fixed by the adversary might be a path that is inefficient to decode. However, by adding 
randomness, we are able to change Sinv such that for any protocol tt, the actual traversed path in 
the StateTree is fully random. This is done by permuting the nodes of the StateTree separately for 
each level. The users need to communicate which permutation is used for each level, which is done 
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by sending the specific permutation in use via additional (potent) tree code, which we denoted as 
the Random nessTree. 

Define the Random nessTree to be a SBTC of degree d\ (for our case d = 12). For a specific node, 
each one of the d\ children denotes one of the possible permutations on d values. Each round, the 
user chooses a random permutation by randomly selecting one of the children of his current position 
in the RandomnessTree (starting from the root). Recall that, in the StateTree, each node has 12 
children where each represents one of {00x0, 00x1, . . .}. We can assume a fixed order, that is, the 
first child always represents 00x0, the second represents 00x1, etc. For a time t, assume the chosen 
permutation is Pf. In our randomized simulation, the i th child in the StateTree has the meaning 
Pt(i)- For instance, the first node represents one of the meanings {00x0, 00x1, . . .}, determined by 

The adapted scheme, Randomized-Sim^, is described in Figure 6. For Theorem 5.6, we assume 
that both the StateTree and the RandomnessTree are (^j, a)-potent trees, which can be achieved 
(with overwhelming probability) by having a large enough (yet a constant) alphabet size. As 
before, we assume each label is sent using an error correcting code, such that the error probability 
per transmission is less then min(|5| -2 , 2~ 82 / a ). Such an error correcting rate imposes a constant 
slowdown, according to Lemma 2.1. 



Begin with own pebble at the root of GameTree and own state Sa at the StateTree root's child labeled 
H x tta(xa,9). Let the randomness-state Ra be the root of the RandomnessTree. Repeat the following 
N times: 

1. Send w(Sa) to user B. 

2. Randomly choose one of the children of Ra- Set the randomness-state Ra to be the chosen child 
and send w(Ra)- 

3. Given the sequence of messages Z received so far from user B, guess the current state g of B and 
the current randomness-state r of B. From the guesses, infer B's pebble movements and compute 
the (alleged) current position pcbblc(g, r) of B's pebble and the bit b outputted by B for this 
round. 

4. Set your pebble movement and new state according to the current position v of your pebble and 
the following: 

(a) if v = pebble(g, r) then move own pebble according to the pair of bits {-ka{xa, v), b) to a 
state v'. The new state is Sa 's child labeled with the arc (ita(xa, v), b) x tta{xa, v'). 

(b) If v is a strict ancestor of pebble(g, r): own movement is H, and the next state is along the 
arc H x tta(xa, v). 

(c) Otherwise, move own pebble backwards. New state is along the arc R x tta{xa, v') where v' 
is the parent of v. 



Figure 6: Interactive protocol Randomized-Sinv for simulating an adversarially chosen protocol tt over 
noisy channels 

Theorem 5.6 immediately follows from the following theorems, 

Theorem 5.7. Assume RandomnessTree and StateTree are , a) -potent trees for some a G (0, 1), 
and assume an oracle for tree- code decoding process, then Randomized-Slvn^ (Figure 6) is an efficient 
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simulation of any protocol ir (that has T rounds). If any label is sent using a error correcting 
code with (label) error probability p, then Randomized-S'\m n succeeds except with probability 4 • 
over the channel errors. 

Theorem 5.8. For a given a G (0,1), suppose that the RandomnessTree and the StateTree are 

RTCs with large enough (yet constant) alphabet size, and thatp < ^l -2 , then the decoding procedure 
(Section 5.2.2) is (i) efficient in expectation, and (ii) correctly decodes a node which is not a -bad. 

We now show that the simulation succeeds except with an exponentially small probability. 
Note that when both the StateTree and RandomnessTree are correctly decoded, the user recovers 
the position of the other user's pebble and the move is successful (in the notion of Lemma 5.4). 
However, if for a time t there is an error either in the StateTree or in the RandomnessTree, the move 
is a bad move. 

Proof. (Theorem 5.7). Assume that a simulation failed, which means more than N/5 bad moves 
have occurred. We fix the path traveled in both trees, and show the probability of having this many 
errors is exponentially small. Since our trees are (^, a)-potent, each path includes bad intervals of 
total length at most N/20, which can contribute towards at most N/10 bad moves, for both trees. 

The rest of the errors have occurred in nodes which are not a-bad, and for at least one of the 
trees, the number of such errors is at least N/20. Consider that specific tree. Each such an error 
is associated with error interval of length k > 1, such that the length of the union of the intervals 
is at least N/20. Using Lemma A. 3, we know there exist disjoint intervals of total length at least 
iV/40 along the same path. Each error interval of length 1^ corresponds to an error of magnitude Zj, 
and since the transmitted node is not a-bad, these errors can only be caused by channel errors. As 
explained above (see proof of Theorem 5.1), the errors which correspond to these disjoint intervals 
are independent, and the probability that a fixed specific pattern of disjoint intervals of total length 
I jointly occur is at most (2p a / 2 ) 1 , where p is the label error probability. 

The probability of having any error pattern of total length at least iV/40 is given by the union 
bound, summing over all possible error patterns in both tree, and over each one of the users. 
There are at most 2 • 2 J2f=N/40 Cj) < 4 • 2^ such combinations, and the probability is bounded by 
4 • 2 N (2p a / 2 ) Ar / 40 , which is exponentially small for p < 2~ 82 / a . □ 

We now show that the decoding procedure described in Section 5.2.2 is efficient in expectation, 
for both the trees. 

Proof. (Theorem 5.8). The Randomized-Sinv scheme makes a random walk 9 on the Random- 
nessTree. Following the analysis of Section 5.2.2, we can choose a constant-size S such that the prob- 
ability of exploring at time t a subtree of depth L(t) = I is bounded by 2~ 7 ' < (dl)~ l (when decoding 
a RandomnessTree node, using the decoding procedure described in Section 5.2.2). Specifically, let 
1 5 1 > (Sd!) 1 ^ 1-0 / 2 ), and require p < \S\~ 2 . The expected time for decoding the RandomnessTree 
during the simulation is given by 

v t=l 7 v t=\ 1=0 ' ' v *=i 



To be more accurate, it is a random walk from the root to a leaf, where the depth can only increase. 
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For a fixed protocol it, each path of the RandomnessTree defines a corresponding path in the 
StateTree. Since the RandomnessTree contains all possible permutations for the StateTree nodes, 
choosing a random path in the RandomnessTree yields a random walk on the StateTree. In the same 
manner as above, the expected time for decoding the StateTree is efficient. 

Property (ii) has been proven in Section 5.2.2, and holds for this case as well. □ 

5.3 Simulating n-Party Protocols 

In this section we extend our result to support a simulation of a protocol n with any number 
n of users. This is done by incorporating the tools described in the previous sections with the 
method of simulating an n-party protocol over a disturbed channel developed by Rajagopalan and 
Schulman [RS94]. The paper [RS94] shows that a scheme for simulating multiparty protocol over 
a disturbed channel exists, yet the question of its efficient implementation has been open since 
1994. The Scheme presented in [RS94] obtains a communication dilation of O(logr) where r is the 
maximal connectivity degree, that is, the maximal number of parties connected to a specific user. 

Rajagopalan and Schulman, in their work [RS94], describe how to adapt the 2-party simulation 
of [Sch96] to an arbitrary number of users. The key idea is to replace the 12-ary StateTree with 
a ternary tree (that is, d = 3), where each node has three child nodes marked with {0, l,bkp}. 
The values and 1 indicate the output bit of the user in the simulated round, and bkp indicates 
that the last simulated round is suspected to be invalid and should be deleted and re-simulated. 
The simulation (described here for a specific user i) is completely defined by the following process. 
Each round, the user uses all the previous communications to infer the current simulated round 
of 7r and sends his output bit to user j (by communicating the label assigned with arc to child 
or 1 respectively, in the ternary StateTree shared between users i and j). If the user finds an 
inconsistency, he transmits bkp which denotes deleting the last received (undeleted) bit and rolling 
the protocol ir one step back. The user shares such a ternary tree with each of the r parties 
connected to him, and is allowed to output a different bit to each party. Yet, when the user decides 
to roll back he outputs bkp on each of the outgoing links. Inconsistency is defined as one of the 
two following cases: (1) the current decoded transcript of the StateTree disagrees with the bits sent 
so far, or (2) the user received bkp from one of his neighbors. We refer the reader to [RS94] for a 
complete description and analysis of this scheme. 

One can easily check that the bulk of the analysis performed in [RS94] applies for the case of 
replacing the good ternary tree code with a ternary SBTC (or RTC). The analysis is composed of 
two parts. The first part shows that if after t rounds the scheme simulates step t — I of tt then at 
least 1/2 errors have occurred in decoding the correct tree- node during the history cone of the user 
at time t (i.e., all the transmissions that affect the user state at time t). The other part bounds 
the probability of having a constant fraction of errors (out of the number of rounds). While the 
first part is completely independent of the fact that we replace the good tree code with a SBTC, 
in order to complete the proof, we must adapt the second part to the usage of SBTC. This is done 
by Lemma 5.11 below. 

Let us formally describe these two parts. We begin by defining the notion of the history 
cone [RS94]. Let (p,t) denote a user p at time t. 

Definition 12 ([RS94]). (p, t) and (p',t r ) are time-like if messages sent by user p at time t has 
an affect on the computation of user p' at time t' (or vice versa). 
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That is, (p, t) and (p, t') are always time-like, and (p, t) and (q, t + 1) are time-like if p and q 
are neighbors. 

Definition 13 ([RS94]). A t time-like path is a sequence {(pi,i) | 1 < i < t] such that any two 
elements in the path are time-like (i.e., for every i, pi and Pi+i are either neighbors or the same 
party). 

The proof of [RS94] follows from the next two lemmas 

Lemma 5.9 (Lemma (5.1.1) of [RS94]). // a user p at time t has successfully simulated only the 
first t — I rounds of tt, then there is a t time-like sequence that ends at (p, t) and includes at least 
1/2 tree- decoding errors. 

Lemma 5.10 (Lemma (5.1.2) of [RS94]). Using error correcting codes with dilation 0(iog(r + 1)), 

the probability that any fixed t time-like path has more than t/A tree-decoding errors, is less than 
l 

(2(r+i))« ' 

The proof of the multiparty case is given by setting t = N = 2T. The first lemma states that if 
the simulation failed (the first N/2 rounds of tt are not valid for some user) then there must exist 
one user who has iV/4 errors along one of his A time-like sequences. The probability of this event 
is bounded by the Lemma 5.10 to be less than ( 2 (r+i)) t summe d over all the N(r + 1)^ possible 
time sequences, which is bounded by N2~ N . 

While the above Lemma 5.9 holds regardless of the tree in use, we prove a variant of the above 
Lemma 5.10 for the case of using a potent tree. Moreover, although Lemma 5.10 holds for any time 
1 < t < N , only t = A is required for completing the proof for the multiparty case, which we prove 
in the following lemma. 

Lemma 5.11. Suppose each two users share a (j^, a) -potent tree, for some a G (0,1). If an 
error correcting code with label error probability p is used, then for any fixed A time-like path, the 
probability that there are more than iV/4 tree-decoding errors is bounded by (2 1 V /2 ) 7V/16 , 

over the 

errors of the channel. 

Proof. We assume an oracle for the decoding process, which can easily be replaced by the efficient 
decoding procedure given in Section 5.2.2, if we use a SBTC. Assume that at least A/4 errors have 
occurred in a specific A time-like path. Fix a specific user i and assume that the errors of this user 
are included in error intervals of total length l{. By Lemma A. 3, there exist disjoint error intervals 
of total length at least U/2. Recall that each error interval of length i corresponds to an error of 
magnitude £, and recall that in each tree, at most A/16ro of the nodes are a-bad. Thus, at least 
ki = max{0,/j/2 — A/16n} of the errors of user i in the A time-like path occur in nodes which 
are not a-bad. These errors can only be originated due to channel errors 10 , and since the intervals 
are disjoint, they are independent. As above (see proof of Theorem 5.1), the probability of having 
errors that correspond to these (fixed) disjoint error intervals is bounded by 2 ki p aki / 2 . Clearly, 
tree-decoding errors of a specific user are independent of the communication (and channel errors) 
of other users. It follows that the probability for all the users to have a total amount of A/4 errors 
matching the fixed intervals pattern is bounded by (2p a / 2 )^ ki . With ]T\ l i > A/4 and at most n 
users, this probability is bounded by (2p a / 2 ) N / 8 - n ( N / 1&n ) = (2p a / 2 ) 7V / 16 . 

10 This claim also applies to the efficient decoding procedure, as it always returns the node that minimized the 
Hamming distance, if it is not a-bad. See the proof of Theorem 5.1 and discussion in Section 5.2.2. 
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Using a union bound we sum the probability over any number j > N/A of errors and over any 
one of the ( N ) different ways to distribute j errors along the fixed time-like path. The probability 
that there are at least iV/4 errors in this fixed N time- like path is bounded by 

! (2p a l 2 yj/ 2 - N / l& < ( 2 17 p Q / 2 ) iV / 16 . 



N 'JV 



E 

j=N/4 



3 

□ 



For p < (5(r + 1)) 32 A* ; this probability is at most ( 2 (r+i)) N ' 

Corollary 5.12. Suppose each two users share a SBTC with \S\ > ((2d) 32n+2 ) 1 /( 1 -°) for some 
a E (0,1), and use an error correcting code with (label) error probability less than p < (5(r + 
l))~ 32 / a . Then, except with probability 2~^ N ^ over the choice of the SBTC, for any fixed N time- 
like path, the probability that there are more than iV/4 tree-decoding errors is less than ( 2 (r+i)) N 
over the the errors of the channel. 

That is, with \S\ > ((2d) 32n+2 ) 1 /( 1_a ) the SBTC is ( j^-, a)-potent, with overwhelming proba- 
bility, due to Proposition 3.4. Each label in an alphabet of size \S\ requires log \S\ = 0(n) bits. 
Due to Lemma 2.1, we can use an error correcting code such that each transmission is 0(n) and the 
label error probability is less than the required (5(r + l)) _32// °. Specifically, for efficient decoding 
we require p < \S\~ 2 , which can be done with code of length 0(n) as well. The above lemma 
replaces Lemma 5.1.2 of [RS94], and leads to the following theorem. 

Theorem 5.13. There exists a constructible and efficient simulation that computes any n-party 
protocol tt of length T using a BSC for communication and a pre-shared SBTC. The simulation 
succeeds with probability 2^^ T ^ , and impose a dilation of 0(n). 

An efficient version of the above scheme, using the efficient decoding methods described in Sec- 
tion 5.2.2, has an expected time complexity of 0(Tr). 
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Appendix 



A Random Tree Codes And Their Properties 

In this section we analyze several of the properties of Random Tree Codes (RTC), and show that a 
RTC is potent, except with high probability. 

Observe that any two paths in a RTC have large enough Hamming distance, except for a 
negligible probability over the choice of the labels. This property makes the RTC a useful code. 

Lemma A.l. Let 1Z be a d-ary RTC over S, and let v\ and v% be any two nodes at some com- 
mon depth h in 1Z, with least common ancestor at depth h — I, then for every < a < 1, 

Pr[A(W(«i),W(«2)) <al] < (r^)' 

Proof. We sum the probability for any possible Hamming distance i = 0, 1, . . . , al. A direct calcu- 
lation gives 

F^WM.WM) <al] < g ( ; < .) (l^i)" < ^ . 

□ 

Assume that v,u are at some depth h, and that their least common ancestor is at depth h — I; 
we say that u and v have a distance I in that case. Assume that the labels W(v) were transmitted. 
If a good tree code is used, then the probability of decoding a different node, u, is exponentially 
small in the distance I, where the probability is over the channel errors. We denote this event as a 
decoding error of magnitude I. In the following lemma we obtain a similar result for a random tree 
code, where in this case the probability is over both the channel errors and the choice of the RTC. 

Finally, we prove Theorem 3.1 by showing that the set of all (e, a)-bad RTC for constants 
e, a € (0, 1), is exponentially small. 

Proposition A. 2. Suppose e,a € (0,1). The probability for a RTC of depth N with alphabet 
\S\ > (2d) (1+2/e)/(1-0l) to be {e,a)-bad, is at most 2~ n ^ 

Proof. We begin by fixing a leaf z, and later we use a union bound to bound the probability over 
the entire tree. Assume that there exist bad intervals of total length at least eN, then there must 
exist disjoint bad intervals of total length at least eN/2, as stated by the following lemma [Sch96]. 

Lemma A. 3 ([Sch96]). Let £i,l2, ■ ■ ■ An be intervals on N, of total length X. Then there exists 
a set of indices L C {1, 2, . . . , n} such that the intervals indexed by L are disjoint, and their total 
length is at least X/2. That is, for any i,j £ I, iid £j = 0, and Yli£i\^\ — A/2. 

The proof is given in [Sch96] . 

There are at most Y^j=eN/2 [j) — ^ N ways to distribute these disjoint intervals along the path 
from the RTC's root to z. Using Lemma A.l and a union bound we are assured that the probability 
of having (any) node u at the same depth as z which imposes a bad interval of length I is less than 
(2d/\S\ 1 ~ a y. The probability for a specific pattern of disjoint bad intervals to jointly occur is the 
multiplication of the probability for each interval to occur (the intervals are independent since they 
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are disjoint). According to the above, for large enough S, the probability for a RTC to be (e, a)-bad 
is bounded by 

Pr[ RTC is (e,a)-bad } <J2 12 W^l^^f 1 

Z tyfa,... disjoint, i 

of length>e7V/2 

< d N ■ 2 N ■ (2d/\S\ 1 - a )^ ei < (2d) N (2d/\S\ 1 - a f N / 2 
which is exponentially small in N for \S\ > (2d ■ (2d) 2 ^) 1 ^ 1 ~ a \ □ 

A.l Construction of a Pseudo-RTC Using Cryptographic Assumptions 

Using conventional cryptographic assumptions and settings one can easily build a pseudo-RTC 
which can not be distinguished from a truly random RTC. In order to construct a pseudo cf-ary 
RTC of depth n, we assume the existence of a family of pseudo-random functions (PRF) [GGM86], 
fx : {0, 1}* — > S, which can be computed efficiently. The user randomly chooses a seed A of length 
k, and labels the arc i with the label f\(i). When a pseudo-RTC is used to communicate between 
several users, they all share the same seed A. 

Lemma A. 4. Let RT be a truly random RTC and let PRT be a pseudo-RTC, then for any algorithm 
A which is polynomial in k, 

|Pr [A RT = 1] - Pr[A PRT = 1]| < neg(K). 

Proof. Otherwise, A is a method to distinguish the pseudo-random function fx used to label the 
RTC from a truly random function, in contradiction to it being a pseudo-random function. □ 

A memoryless BSC channel can be considered as a (very restricted) polynomial-time algorithm. 
The seed A for the PRF can be chosen by one party, encoded using any good error-correcting code, 
and sent to the other party at the start of the protocol. Note that since all parties are honest, and 
the channel is efficiently simulatable, there is no need to hide the PRF's seed. It follows that we 
can replace any use of RTC with a pseudo-RTC, affecting the probabilities with only a negligible 
factor. 

B Details of Theorem 4.1 

We now prove Theorem 4.1. The proof follows the analysis of Braverman and Rao [BRIO] in a 
straightforward way, assuming the tree code in use is (ei, 1 — e2)-potent (that is, a = 1 — 62). 

In [BRIO] the users consider tt as a binary tree T ■ Each path in the tree describes a possible 
transcript of 7r, where odd levels describe party A's outputs and even levels describe B's outputs. 
The users use a good tree code to communicate the vertices of T according to their inputs. 

Assume that at time t user A sends at and let a' t be the label received at B's side (similarly, 
User B sends bt, etc.). Upon receiving a' t , user B decodes the received string a' x , . . . , a' t and obtains 
a possible transcript of it, from which he can compute his next step in tt. This process is repeated 
for R = \T/e2~\ times. 

Let D(a' 1 , . . . ,a' t ) denote a set of vertices in T described by decoding the received string. We 
denote with m(i) the largest number such that the first m(i) symbols of D(a'i, . . . , a^) are equal to 
a%,...,ai and the first m(i) symbols of D(bi, . . . , 6'J are equal to b%, ... , 6j. 
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Define J\f(i,j) to be the number of transmission errors in the interval of the simulation 
(for both users). In the analysis of [BRIO], a lower bound on the number of error in case that the 
simulation fails. We now show that using a (ex, 1 — e2)-potent tree, the lower bound changes by at 
most ex- 

The analysis of [BRIO] begins by considering a simpler simulation in which the alphabet size 
might be polynomial, and then extends the result to a constant alphabet size in a straightforward 
way. In order to ease the proof, we show that the theorem holds for the simple protocol with 
polynomial alphabet. Extending the result to the constant-alphabet protocol is immediate. 

Proof. (Theorem 4.1.) We redefine the quantity J\f to allow us consider possible errors caused 
by the tree in addition to channel errors. Let N(i,j,d) be the number of communication errors 
between rounds i and j, assuming that the total length of bad intervals along the paths Oj, . . . ,dj 
and bi, . . . ,bj in the potent tree, is at most d. 

Lemma B.l (replacing lemma 4 of [BRIO]). M{m{i) + l,i,d) > (1 — e 2 )(i — m(i))/2 — d 

Proof. Without loss of generality, we assume that the m(i) + 1 symbol in D(a'i, . . . , a^) differs from 
a m(i)+i- Consider two cases. If the node en is not a-bad, then the only way to get a decoding error 
of magnitude I = (i — (m(i)) is if at least al/2 = (1 — e 2 )(2 — m(i))/2 communication errors have 
happened (this is identical to [BRIO]). 

In the second case, the node is a-bad. If i — m(i) < d the lemma is trivial. Otherwise, <ij 
must be an a-bad node of maximal length at most d. A(ax • • • a%, a'x ■ ■ ■ a^) > a(i — m(i)) and again 
such a decoding error implies at least (1 — e 2 )(« — m(i))/2 communication errors. □ 

The quantity t(i) is defined by [BRIO] as the smallest round j such that both users announced 
the first i edges of T within their transmisssions. The following Lemma is stated in [BRIO]. 

Lemma B.2 (Lemma 5 of [BRIO]). For i>0,k>l, if i + 1 < t(k), then m(i) < t(k - 1) 

The proof of this lemma is independent of the tree code in use, and thus it is valid for simulation 
with potent tree as well. 

Last, we show the following lower bound on the number of errors. 

Lemma B.3 (replacing lemma 6 of [BRIO]). For i > —l,k > 0, if i + 1 < t(k), then J\f(l,i,d) > 
(t-fc + l)(l-e 2 )/2-d 

Proof. We prove by induction. jV(l, i, d) = J\f(l,m(i),x) + M(m(i) + 1, i, d — x) assuming that 
the total length of the imposed bad-intervals between rounds 1 and m(i) (that is, along the 
paths ax,...,a m (j) and bi, . . . , b m u\) is exactly x, < x < d. Lemma B.l guarantees that 
J\f(m(i) + l,i,d - x) > (1 - e 2 ){i - m(i))/2 - (d - x). By Lemma B.2, m(i) < t(k - 1) and 
we can use the induction hypothesis on the first part, which gives JV(1, m(i) — 1, x) > ({m(i) — 1) — 
(k — 1) + 1)(1 — e 2 )/2 — x. Summing these two bounds proves the lemma. □ 

Note that the in the case of a good tree code, d = 0, which gives exactly Lemma 6 of [BRIO] . With 
a potent tree, d < 2e\N which reduces the maximal error rate by 2ei. 

In a similar way Lemma 8 of [BRIO] can be adapted to potent trees, which completes the proof 
of Theorem 4.1, by setting e > ex/2 + e 2 . 

□ 
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